WaterDrum: Watermarking for Data-centric Unlearning Metric

TL;DR

WaterDrum reframes LLM unlearning evaluation as a data-centric problem by embedding per-owner watermarks into training data and verifying watermark signals in model outputs. Built atop the Waterfall text watermarking framework, WaterDrum defines a scalable metric $M'$ that quantifies residual forgotten data without requiring retraining, and it demonstrates strong separability, calibration, practicality, resilience, and threat-model robustness. The paper introduces the WaterDrum-Ax benchmark with 8000 ArXiv abstracts across 20 categories to simulate realistic forget/retain splits and varying data similarity, enabling thorough evaluation of unlearning algorithms. Empirical results show WaterDrum outperforms traditional utility-based metrics in key desiderata and provides a practical tool for benchmarking unlearning methods in real-world, data-sharing contexts.

Abstract

Large language model (LLM) unlearning is critical in real-world applications where it is necessary to efficiently remove the influence of private, copyrighted, or harmful data from some users. However, existing utility-centric unlearning metrics (based on model utility) may fail to accurately evaluate the extent of unlearning in realistic settings such as when (a) the forget and retain set have semantically similar content, (b) retraining the model from scratch on the retain set is impractical, and/or (c) the model owner can improve the unlearning metric without directly performing unlearning on the LLM. This paper presents the first data-centric unlearning metric for LLMs called WaterDrum that exploits robust text watermarking for overcoming these limitations. We also introduce new benchmark datasets for LLM unlearning that contain varying levels of similar data points and can be used to rigorously evaluate unlearning algorithms using WaterDrum. Our code is available at https://github.com/lululu008/WaterDrum and our new benchmark datasets are released at https://huggingface.co/datasets/Glow-AI/WaterDrum-Ax.

Figures (14)

• Figure 1: Unlike existing utility-centric metrics, WaterDrum satisfy the desiderata in \ref{['sec:problem_formulation']}. WaterDrum is robust to similar data as Waterfall embed orthogonal data-specific signals in the LLM output that are \ref{['w:verifiability']} verifiable.
• Figure 2: Overview of the watermarking process of WaterDrum
• Figure 3: Plots of unlearning metrics against the % of $\mathcal{D}_{\mathcal{F}}$ remaining in the retrained model, under settings with different levels of data similarity for the WaterDrum-Ax dataset. Note that except WaterDrum, no other metrics are calibrated and satisfy \ref{['d:calibration']}. Associated $R^2$ are in \ref{['tab:calibration_similarity_arxiv']}.
• Figure 4: Plot of forget watermark strength (WaterDrum metric) over $\%$ of queries in $Q$ intercepted, as the model owner increases its filtering threshold $B$ under the threat model $\mathbb{T}$. The best possible unlearning metric against $\mathbb{T}$ will have its score decrease only proportionally (dotted orange diagonal line). WaterDrum achieves a similar performance, implying that the threat model requires intercepting a large proportion of queries to reduce the metric detectable by the forget set data owner. Watermark strength is scaled to 1.0 for $Q$ before the threat model is implemented.
• Figure 5: Benchmark of existing unlearning methods with WaterDrum on the WaterDrum-Ax. The green lines represent the optimal unlearning values.